---
id: CVE-2026-23226
title: 'ksmbd: add chann_lock to protect ksmbd_chann_list xarray'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: add chann_lock to protect ksmbd_chann_list xarray

  ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in
  multi-channel sessions (between look…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d <
    43ad494ac6e940a8eabf25d5bd77bb3bb53b1153
  - >-
    Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d <
    4c2ca31608521895dd742a43beca4b4d29762345
  - >-
    Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d <
    e4a8a96a93d08570e0405cfd989a8a07e5b6ff33
  - >-
    Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d <
    36ef605c0395b94b826a8c8d6f2697071173de6e
  - >-
    Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d <
    4f3a06cc57976cafa8c6f716646be6c79a99e485
  - Linux b1caecbf34b8c8260d851ec4efde71f3694460b7
  - Linux 91bbf9cb2387a0d76322e9a343bc6bc160f66b3f
  - Linux 853c416710b075153c1e1421e099ffbe5dac68ce
  - Linux >= 5.15.145 < 5.16
  - Linux >= 6.1.29 < 6.2
  - Linux >= 6.2.16 < 6.3
  - Linux 6.3
published: '2026-02-18'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:01.586Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23226'
references:
  - url: 'https://git.kernel.org/stable/c/43ad494ac6e940a8eabf25d5bd77bb3bb53b1153'
  - url: 'https://git.kernel.org/stable/c/4c2ca31608521895dd742a43beca4b4d29762345'
  - url: 'https://git.kernel.org/stable/c/e4a8a96a93d08570e0405cfd989a8a07e5b6ff33'
  - url: 'https://git.kernel.org/stable/c/36ef605c0395b94b826a8c8d6f2697071173de6e'
  - url: 'https://git.kernel.org/stable/c/4f3a06cc57976cafa8c6f716646be6c79a99e485'
tags:
  - cve.org
epss: 0.00479
epssPercentile: 0.41138
ingestedAt: '2026-10-21T12:48:53.676Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add chann_lock to protect ksmbd_chann_list xarray

ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in
multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del).

Adds rw_semaphore chann_lock to struct ksmbd_session and protects
all xa_load/xa_store/xa_erase accesses.

## Affected

- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 43ad494ac6e940a8eabf25d5bd77bb3bb53b1153`
- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 4c2ca31608521895dd742a43beca4b4d29762345`
- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < e4a8a96a93d08570e0405cfd989a8a07e5b6ff33`
- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 36ef605c0395b94b826a8c8d6f2697071173de6e`
- `Linux >= 1d9c4172110e645b383ff13eee759728d74f1a5d < 4f3a06cc57976cafa8c6f716646be6c79a99e485`
- `Linux b1caecbf34b8c8260d851ec4efde71f3694460b7`
- `Linux 91bbf9cb2387a0d76322e9a343bc6bc160f66b3f`
- `Linux 853c416710b075153c1e1421e099ffbe5dac68ce`
- `Linux >= 5.15.145 < 5.16`
- `Linux >= 6.1.29 < 6.2`
- `Linux >= 6.2.16 < 6.3`
- `Linux 6.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.